Proxmox Firewall Precedence: Why a VM-Level Allow Rule Still Gets Dropped at the Datacenter Level
How Proxmox's Datacenter, Node, and VM firewall layers actually stack, and why an allow rule on a guest can still get silently dropped.
$ ls ./networking
Networking
The MTU Mismatch That Makes SSH Work Over WireGuard But Breaks Everything Else
Why a WireGuard tunnel can pass SSH and ping fine while web pages and file transfers hang, and how to fix it by getting the MTU right.
Split-Horizon DNS: Why Your Reverse Proxy Setup Needs Two Different Answers for the Same Hostname
How to make service.example.com resolve to a different address inside your LAN than it does on the public internet, and why skipping this causes broken NAT hairpinning and cert mismatches.
The Duplicate Machine ID Hiding Inside Every VM You Clone From a Template
Cloning a Proxmox VM template can leave every child VM sharing the same /etc/machine-id and SSH host keys. Here's why that happens and how to fix it.
systemd-resolved Owns Port 53 Before Pi-hole Ever Gets a Chance
Why Pi-hole or AdGuard Home fails to bind port 53 on a fresh Debian/Ubuntu host, and the difference between disabling the stub listener and actually freeing the port.
The VM Clock That's a Few Minutes Off After Every Snapshot Rollback
Why restoring a Proxmox VM snapshot leaves the guest clock drifted, and why that quietly breaks TLS and TOTP auth until NTP catches up.
ip neigh show Lies: Always arping Before You Assign a Static LAN IP
ip neighbor show only reflects hosts that have talked recently. An absent ARP entry does not mean an IP is free — here's why that matters and the one-line check that actually proves it.